Auror: defending against poisoning attacks in collaborative deep learning systems

By Shiqi Shen, Shruti Tople, Prateek Saxena. 2016

365 citations recorded by the source corpus.

Subfields: Artificial Intelligence, Safety, Robustness & Interpretability, Privacy & Security, Signal Processing

How researchers see this paper

The researchers whose trusted networks rank it highest, strongest advocate first. Every researcher gets a different order.

In Artificial Intelligence

In Safety, Robustness & Interpretability

In Privacy & Security

In Signal Processing

Citations in the corpus

How To Backdoor Federated Learning (2018, background): “mpacting its performance on the main task. Defenses against poisoning focus on removing outliers from the training data [33, 39] or, in the distributed learning setting, from the participants’ models [35]. In Section 6, we explain why these defenses are ineffective against our attack. Attacks on tes”
Backdoor Attacks on Federated Meta-Learning (2020, methodology): “The same assumption was made in [12, 13, 19, 16, 17, 20, 21], where outliers were detected and removed according to slightly different measures taken from the distribution of benign values (benign users were assumed to be the majority).”
A Little Is Enough: Circumventing Defenses For Distributed Learning (2019, methodology): “A defense method of (Shen et al., 2016) clusters each parameter into two clusters using 1-dimensional k-means, and if the distance between the clusters’ centers exceeds a threshold, the values compounding the smaller cluster are discarded.”
Mitigating Sybils in Federated Learning Poisoning (2018, background): “s centralized, but are complex to apply in a federated learning setting, where access to the data is prohibited. This algorithm also assumes control of the gradient computation during training. AUROR [36] is a defense designed for the multiparty ML setting. It deﬁnes indicative features to be the mo”
BadNets: Identifying Vulnerabilities in the Machine Learning Model Supply Chain (2017, background): “l inputs, since recognizing some particular property of an input and treating such inputs specially is within the intended use case of a neural network. Closest to our own work is that of Shen et al. [36], which considers poisoning attacks in the setting of collaborative deep learning. In this setti”
Contamination Attacks and Mitigation in Multi-Party Machine Learning (2018, background): “This setting already encourages each party to supply data that benefits the others as opposed to supplying a dummy dataset with the goal of either learning more information about other parties or decreasing the overall accuracy of the model [4, 19, 38].”
Mitigating Evasion Attacks to Deep Neural Networks via Region-based Classification (2017, background): “Various studies have demonstrated poisoning attacks to spam filter [16], support vector machines [1], deep neural networks [20], and recommender systems [10, 24].”
On the (Statistical) Detection of Adversarial Examples (2017, methodology): “l. 9 Related Work Other approaches to detect malicious data points by statistical means have been proposed. However, they all depend on some of the internal activations of deep neural networks models [18, 28]. Hence, these approaches only apply to the speciﬁc classiﬁer studied. In contrast, we apply”
Fawkes: Protecting Privacy against Unauthorized Deep Learning Models (2020, background): “r dataset. We also discuss mitigations the user could apply to avoid detection. Existing Poison Attack Detection. Since cloaking is a form of data poisoning, prior work on detecting poisoning attacks [11,19,40,46,49,58] could be helpful. However, all prior works assume that poisoning only affects a ”
Understanding Distributed Poisoning Attack in Federated Learning (2019, background): “, launching targeted poisoning attacks on a classifier which distinguishes handwritten digits 0 to 9, the easiest and hardest source and target label pairs are (6, 2) and (8, 4), respectively [16].”
A Robust Privacy-Preserving Federated Learning Model Against Model Poisoning Attacks (2024, methodology): “Due to maintaining parity with the compared academic literature such as [3], [5], [6], [7], [10], and [33], the logistic regression classifier model and three classification datasets: MNIST, KDDCup, and Amazon, under both IID and non-IID settings, is considered for evaluation and to ensure a fair…”
Federated Learning for Malware Detection in IoT Devices (2021, background): “The most interesting ones to be assessed as future work are Krum [18], Bulyan [43] and AUROR [44].”
Poisoning Attack in Federated Learning using Generative Adversarial Nets (2019, background): “Besides, existing defense mechanisms against poisoning attacks, such as robust losses [22] and anomaly detection”
The Limitations of Federated Learning in Sybil Settings (2020, background): “Existing work has explored several ways to defend the FL training process [9, 50, 60, 61].”
A Comprehensive Survey on Poisoning Attacks and Countermeasures in Machine Learning (2022, methodology): “[113] proposed the malicious clients detection method Auror.”
Mitigating Evasion Attacks to Deep Neural Networks via Region-based Classification (2018, background): “Various studies have demonstrated poisoning attacks to spam filter [22], support vector machines [1], deep neural networks [26], and recommender systems [15, 30].”